t-mobile[.]yftze[.]icu

On 23 July 2026, investigators recorded the domain t-mobile.yftze.icu. The domain was registered on 21 February 2026 and immediately pointed to the IPv6 address 2a06:98c1:3120::3, which belongs to the Cloudflare network (AS13335) located in the United States. The site presented the page title “T‑Mobile Tuesdays – Get Free Stuff & Great Deals | T‑Mobile”, yet the underlying threat profile lists Apple as the impersonated brand and classifies the operation as a tech‑support scam. The SSL certificate is identified only as “WE1”, providing no additional validation of the issuer. Automated reputation services have assigned a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust.

VirusTotal analysis shows that 13 of 93 scanned security vendors flagged the domain, confirming malicious intent, and the domain appears on a single public blocklist. The PhishDestroy blocklist has already taken the domain offline, and current monitoring indicates the site is no longer reachable. Evidence confirms that the infrastructure relies on a shared Cloudflare edge, which complicates direct takedown but also offers a convenient vector for fast‑flux style hosting. The combination of a brand‑specific page title unrelated to the targeted brand, the tech‑support scam designation, and the low trust scores suggests the site was intended to lure victims into contacting purported support staff or to harvest credentials under the guise of Apple assistance.

However, the exact payload or credential‑capture mechanism has not been observed, and the site’s content beyond the title remains unverified. Defenders should continue to block the domain at DNS and proxy layers, monitor for any outbound connections to the listed IPv6 address, and add the domain to internal threat intelligence feeds.